Privacy at Google Contents Introduction 2 Google’s privacy principles: Transparency and user choice 3 Putting principles into practice 5 Search 5 Strengthening Google’s privacy practices 8 Why Google stores data 10 Personalization 12 Targeted advertising 16 Other Google products 18 Helping to protect users 21 Frequently asked questions 23 Glossary 27 Appendix 29 Introduction As the information age becomes a reality for increasing numbers of people globally, the technologies that underpin it are getting more sophisticated and useful. The opportunities are immense. For individuals, a quantum leap forward in their ability to communicate and create, speak and be heard; for national economies, accelerated growth and innovation. However, these technological advances do sometimes make it feel as if our lives are now an open book. Credit cards record where we shop and what we buy. Mobile phones track our every movement. Emails leave a trail of who we ‘talk’ to, and what we say. And blogs, video sharing sites and social networks make it possible to share almost anything (photos, home movies, one’s innermost thoughts) with almost anyone. That’s why Google believes it’s so important to have clear privacy policies - policies that are based on the principles of transparency and choice. Our users deserve to know what information is being collected and stored, and why, so that they can make informed decisions about the Google services they use. We hope that this booklet will help you better understand what Google is doing to protect our users’ privacy and to help raise standards across the industry. Peter Fleischer Global Privacy Counsel 2 Google’s privacy principles: Transparency and user choice All of us now trust companies with information online that is personal or sensitive. But it’s sometimes difficult to work out exactly what information these organizations collect, or how they use it. For a start, most privacy policies are long, complicated documents that are hard to understand. And technology is changing all the time. That’s why Google believes it’s critical to be transparent about our approach to privacy and to give users meaningful control – we want people to understand what data we store and why, so that they can make informed decisions about the services they use. Transparency and user choice are the principles on which all Google’s privacy policies are based. Google designs products to put the user in control We build privacy protections into our services from the ground up. Take Web History for example, a sign-in feature which allows users to look back over sites they have visited or searched for in the past. If people don’t want particular entries stored they can delete them. Or Google Talk, our instant messaging service. If users want their conversations to be “off the record,” all they have to do is click a button. None of Google’s products use personal data unless fully disclosed in a privacy policy Privacy policies are legal documents that provide people with notice about the information companies collect, and obtain their consent to its use. Personal data is information that relates to a particular identifiable individual. At Google we aim to write our privacy policies in clear, simple language Google tries to keep our privacy policies as short and simple as possible – with a one page summary at the top, followed by more detail underneath for users who are interested. To read our privacy policies go to http://www.google.com/privacy. In addition Google is experimenting with privacy videos to help inform users about what we do and why: just visit http://www.youtube.com/googleprivacy to see them all. 3 We always ask people actively to opt in to services that use their sensitive data Sensitive data is information about a person’s health, sexual orientation or political beliefs, for example. So for a product like Gmail – which may store sensitive personal data contained in people’s email – we always ask users to opt in to the storage of sensitive data in the service by opening an account. 4 Putting principles into practice Search Search - the ability to deliver relevant information on any topic to anyone, anywhere, instantly - is at the heart of what Google does. Today millions of people globally use our search engine. But what happens when people type their query into that box on our homepage – and what data, if any, do we store about that search? Data retention practices Let’s take a simple search like cars. When someone types the word “cars” into our search engine, the request gets sent from that user’s computer over the Internet to our computers, which look for the right search results. Once our computers have found the results, they send these results back to the user’s computer – again via the Internet. All this takes milliseconds. This is the information that Google keeps: the search query (i.e., “cars”), the time and date it was typed, the IP address and cookie of the computer it was entered from, and its browser type and operating system. Like almost all websites, we keep these records in our logs. Here’s what a typical log entry at Google looks like: 123.45.67.89 - 25/Mar/2007 10:15:32 - http://www.google.com/search?q=cars - Firefox 2.0.0.7; Windows NT 5.1 - 740674ce2123e969. But what does this all mean? 5 IP addresses: 123.45.67.89 is the IP address assigned to the user’s computer by his or her service provider. An IP address is a number assigned to each individual computer. When a user searches on Google, we use his computer’s IP address to ensure that we get the right results back to the right computer. It’s important to remember that IP addresses don’t say exactly where an individual user is, or who they are. In fact, some Internet Service Providers (ISPs) give users a different IP address every time they log onto the web. At best, all Google can tell about a user from his computer’s IP address is that user’s general location (for example London), and possibly the ISP they use to connect to the Internet. Only the ISP (who actually controls the user’s account), can match an individual with an IP address. Time and date: 25/Mar/2007 10:15:32 is the date and time the user typed the query into Google. Search query: http://www.google.com/search?q=cars is the search query, in this specific case “cars.” Browsers and operating systems: Firefox 2.0.0.7; Windows NT 5.1 is the browser and operating system being used. A browser - like Internet Explorer, Mozilla Firefox, Safari or Opera - is the software that enables computers to access the web. An operating system - like Windows - is the software that manages a user’s computer. Cookies: 740674ce2123a969 is the unique cookie ID assigned to a computer the first time a user visits Google. A cookie is, a cookie is a small file that gets stored on a user’s computer; it looks like a lot of numbers, letters and symbols strung together. Like an IP address, a cookie doesn’t tell Google who a user actually is or where they live - it only identifies a computer. A user can delete cookies at any time through the cookie-control panel in his computer’s browser, as explained in detail below. A cookie records users’ 6 preferences, for example whether a user wants his results in English or French, or if he wants to use a SafeSearch filter. 7 Strengthening Google’s privacy practices Time limits on data retention While none of the data Google stores in its search logs identifies individuals personally, it can sometimes have personal elements, because it involves specific queries. For example, if a user runs a search on her own name and city, that search query reveals more information about a user than our prior example of a search for “cars.” That’s why earlier this year Google decided to delete the last two digits from the IP addresses and alter the cookie numbers in our logs permanently after 18 months. This breaks the link between the search query and the computer it was entered from. It’s similar to the way in which credit card receipts replace digits with hash marks to improve customer security. Here is what an IP address will look like in our logs after 18 months: 123.45.67.XX. After the same time period, the cookie will be replaced by a newly-generated cookie number. Google was the first search engine to place time limits on the retention of logs data and we’re pleased that others in the industry have followed our lead. Time limits on cookies In addition Google has decided to limit the lifetime of its cookies. When we originally designed them, we set our cookies to expire well into the future - 2038, to be exact - because their primary purpose was to preserve people’s preferences, not to allow them to be forgotten. But Google now plans to start issuing cookies that auto-expire after two years - unless they belong to someone who uses our services regularly, in which case the cookie will automatically renew itself. In other words, people who do not return to Google will have their cookies deleted after two years, while those who use the service regularly will have a cookie renewed for two years from the point that they use our services, and consequently will not lose their preferences. 8 Google has always allowed people to use its services without cookies (though this may mean losing the use of some features or functions of particular products).